Linux Kernel any version

bnxt_en: Fix double DMA unmapping for XDP_REDIRECT

Sensitive data disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 39938, Acronis Cyber Protect 15 (Linux, Windows) before build 41800.

BUG-000179884 - There is a security vulnerability in ArcGIS Server Feature Services.

9p: avoid putting oldfid in p9_client_walk() error path

net: stmmac: fix TSO DMA API usage causing oops

Sensitive data disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 39938, Acronis Cyber Protect 15 (Linux, Windows) before build 41800.

netfilter: socket: Lookup orig tuple for IPv6 SNAT

net: stmmac: dwmac-tegra: Read iommu stream id from device tree

bus: mhi: ep: Update read pointer only after buffer is written

Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)

Use after free in Browser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

Command Injection

The FILES directive inside a VM template allows execution of uploaded files when the template is instantiated, resulting in a Remote Code Execution (RCE) attack.

IBM Security Guardium command execution

IBM Aspera Faspex XML external entity injection

Portal for ArcGIS has a directory traversal vulnerability.

AMD Chipset Driver Information Disclosure Vulnerability

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user on the network can cause an out-of-bounds write through a specially crafted shader, which may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering. The scope of the impact may extend to other components.

Disk Cache Deserialization Remote Code Execution Vulnerability

Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

Remote Code Execution via Code Validation Endpoint

NVIDIA OpenShell for Linux contains a vulnerability in its sandbox provisioning API, where an attacker could cause an incomplete list of disallowed inputs. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, data tampering, and denial of service.

Policies Component Dynamic CodeInput Fields Bypass Custom Component Validation

Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)

NVIDIA OpenShell for Linux contains a vulnerability where an attacker could cause a sandbox escape. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.

Command Injection

Path traversal in Centreon Open Tickets

Path Traversal in APIRequest Component via Content-Disposition Header

Adobe Campaign Classic (ACC) | Improper Input Validation (CWE-20)

Arbitrary Code Execution in Python Interpreter Component

Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)

Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)

IBM Aspera Faspex code execution

AnyDesk before 5.5.3 on Linux and FreeBSD has a format string vulnerability that can be exploited for remote code execution.

Incorrect authorization controls in PaperCut NG/MF APIs

Authentication bypass in UniRPC's udadmin service

Stack buffer overflow in UniRPC's udadmin_server service

An issue was discovered in net/tipc/crypto.c in the Linux kernel before 5.14.16. The Transparent Inter-Process Communication (TIPC) functionality allows remote attackers to exploit insufficient validation of user-supplied sizes for the MSG_CRYPTO message type.

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate.